<p>Server-side encryption (SSE) encrypts an object (not the metadata) as it is written to disk (where the S3 bucket resides) and decrypts it as it is
read from disk. This doesn’t change the way the objects are accessed, as long as the user has the necessary permissions, objects are retrieved as if
they were unencrypted. Thus, SSE only helps in the event of disk thefts, improper disposals of disks and other attacks on the AWS infrastructure
itself.</p>
<p>There are three SSE options:</p>
<ul>
  <li> Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)
    <ul>
      <li> AWS manages encryption keys and the encryption itself (with AES-256) on its own. </li>
    </ul>  </li>
  <li> Server-Side Encryption with Customer Master Keys (CMKs) Stored in AWS Key Management Service (SSE-KMS)
    <ul>
      <li> AWS manages the encryption (AES-256) of objects and encryption keys provided by the AWS KMS service. </li>
    </ul>  </li>
  <li> Server-Side Encryption with Customer-Provided Keys (SSE-C)
    <ul>
      <li> AWS manages only the encryption (AES-256) of objects with encryption keys provided by the customer. AWS doesn’t store the customer’s
      encryption keys. </li>
    </ul>  </li>
</ul>
<h2>Ask Yourself Whether</h2>
<ul>
  <li> The S3 bucket stores sensitive information. </li>
  <li> The infrastructure needs to comply to some regulations, like HIPAA or PCI DSS, and other standards. </li>
</ul>
<p>There is a risk if you answered yes to any of those questions.</p>
<h2>Recommended Secure Coding Practices</h2>
<p>It’s recommended to use SSE. Choosing the appropriate option depends on the level of control required for the management of encryption keys.</p>
<h2>Sensitive Code Example</h2>
<p>Server-side encryption is not used:</p>
<pre>
const s3 = require('aws-cdk-lib/aws-s3');

new s3.Bucket(this, 'id', {
    bucketName: 'default'
}); // Sensitive
</pre>
<p>Bucket encryption is disabled by default.</p>
<h2>Compliant Solution</h2>
<p>Server-side encryption with Amazon S3-Managed Keys is used:</p>
<pre>
const s3 = require('aws-cdk-lib/aws-s3');

new s3.Bucket(this, 'id', {
    encryption: s3.BucketEncryption.KMS_MANAGED
});

# Alternatively with a KMS key managed by the user.

new s3.Bucket(this, 'id', {
    encryption: s3.BucketEncryption.KMS_MANAGED,
    encryptionKey: access_key
});
</pre>
<h2>See</h2>
<ul>
  <li> <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/serv-side-encryption.html">AWS documentation</a> - Protecting data using
  server-side encryption </li>
  <li> <a href="https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.BucketEncryption.html">AWS CDK version 2</a> - BucketEncryption </li>
</ul>
